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AMENDMENTS TO THE CLAIMS 

This listing of claims replaces all prior versions, and listings, of claims in the application: 
Listing of Claims : 
1-29. (Cancelled) 

30. (New) In a network that includes a user computer, a web server and a third party, a 
method for mitigating a cross-site scripting attack by the third party on a response served by the 
web server to the user computer, the method comprising: 

receiving an HTTP request at the web server, the HTTP request having been sent 
by the user computer and requesting a response that includes text and HTML elements; 

before dynamic rendering of the HTTP request, using a script module of the 
server computer to examine the HTTP request for script constructs identified in an 
updateable list of markers of active content stored at the web server, wherein examining 
the HTTP request for script constructs consists of examining only HTML elements where 
user input is introduced; 

finding a script construct within a particular HTML element; 

in response to finding the script construct within the particular HTML element, 
generating an error and aborting processing of the HTTP request; and 

informing the user computer that the script construct has been found in the HTTP 
request; and 

requesting that the user computer resubmit a request. 

31. (New) The method recited in claim 30, wherein the particular HTML element is an 
event. 

32. (New) The method recited in claim 30, wherein the event is an onclick event. 

33. (New) The method recited in claim 30, wherein the particular HTML element is an 
expression. 
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34. (New) The method recited in claim 30, wherein the particular HTML element is a value 
of a name/value pair. 

35. (New) The method recited in claim 30, wherein the particular HTML element is a value 
of a tag attribute/value pair. 

36. (New) The method recited in claim 30, wherein the particular HTML element is an 
anchor in an href attribute. 

37. (New) The method recited in claim 30, wherein the particular HTML element is an 
element size. 

38. (New) The method as recited in claim 30, further comprising: 
maintaining, at the server, the updateable list of markers of active content. 

39. (New) The method recited in claim 30, wherein receiving the HTTP request includes 
receiving and examining each of: 

a query string; 

a field of an HTTP form; and 
a header. 

40. (New) The method recited in claim 30, wherein the HTML elements where user input is 
introduced include at least one of: 

form variables; 
query string variables; 
URLs with key value pairs; or 
headers. 

41 . (New) The method recited in claim 30, further comprising: 

In response to finding the script construct within the particular HTML element, 
generating an error event and logging the error event for administrative review. 
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42. (New) The method recited in claim 40, wherein the error event is logged for 
administrative review. 

43. (New) The method recited in claim 30, further comprising encoding user input to render 
the script construct inert. 

44. (New) A computer program product for use in a network that includes a user computer, a 
web server and a third party, the computer program product including computer-executable 
instructions stored on a computer-readable storage medium that, when executed by a processor, 
cause the web server to perform the method of claim 30. 

45. (New) In a network that includes a user computer, a web server and a third party, a 
method for mitigating a cross-site scripting attack by the third party on a response served by the 
web server to the user computer, the method comprising: 

maintaining, at the web-server, an updateable list of script constructs; 

receiving an HTTP request at the web-server, wherein the HTTP request includes a 
request for dynamic content in the form of an embedded link; 

before dynamic rendering of the HTTP request, using a script module of the server 
computer to examine HTTP request to identify script constructs identified in the updateable list 
of script constructs, wherein examining the HTTP request to identify script constructs consists of 
examining only the request for dynamic content in the form of the embedded link and other 
HTML elements where user input is introduced; 

finding a script construct within the request for dynamic content in the form of an 
embedded link; 

in response to finding the script construct, generating an error and aborting processing of 
the HTTP request, thereby refraining from executing any portion of the HTTP request; 

informing the user computer that the script construct has been found in the HTTP request; 

and 

requesting that the user computer resubmit a request. 
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